[GWP-ASan] enable/disable and fork support.
Summary:
* Implement enable() and disable() in GWP-ASan.
* Setup atfork handler.
* Improve test harness sanity and re-enable GWP-ASan in Scudo.
Scudo_standalone disables embedded GWP-ASan as necessary around fork().
Standalone GWP-ASan sets the atfork handler in init() if asked to. This
requires a working malloc(), therefore GWP-ASan initialization in Scudo
is delayed to the post-init callback.
Test harness changes are about setting up a single global instance of
the GWP-ASan allocator so that pthread_atfork() does not create
dangling pointers.
Test case shamelessly stolen from D72470.
Reviewers: cryptoad, hctim, jfb
Subscribers: mgorny, jfb, #sanitizers, llvm-commits
Tags: #sanitizers, #llvm
Differential Revision: https://reviews.llvm.org/D73294
GitOrigin-RevId: 596d06145a2b94fa9549f0e8cadc641586dfab1d
diff --git a/guarded_pool_allocator.cpp b/guarded_pool_allocator.cpp
index df45477..214b5a8 100644
--- a/guarded_pool_allocator.cpp
+++ b/guarded_pool_allocator.cpp
@@ -58,7 +58,9 @@
// Gets the singleton implementation of this class. Thread-compatible until
// init() is called, thread-safe afterwards.
-GuardedPoolAllocator *getSingleton() { return SingletonPtr; }
+GuardedPoolAllocator *GuardedPoolAllocator::getSingleton() {
+ return SingletonPtr;
+}
void GuardedPoolAllocator::AllocationMetadata::RecordAllocation(
uintptr_t AllocAddr, size_t AllocSize, options::Backtrace_t Backtrace) {
@@ -156,9 +158,9 @@
// Multiply the sample rate by 2 to give a good, fast approximation for (1 /
// SampleRate) chance of sampling.
if (Opts.SampleRate != 1)
- AdjustedSampleRate = static_cast<uint32_t>(Opts.SampleRate) * 2;
+ AdjustedSampleRatePlusOne = static_cast<uint32_t>(Opts.SampleRate) * 2 + 1;
else
- AdjustedSampleRate = 1;
+ AdjustedSampleRatePlusOne = 2;
GuardedPagePool = reinterpret_cast<uintptr_t>(GuardedPoolMemory);
GuardedPagePoolEnd =
@@ -169,6 +171,31 @@
// race to members if received during init().
if (Opts.InstallSignalHandlers)
installSignalHandlers();
+
+ if (Opts.InstallForkHandlers)
+ installAtFork();
+}
+
+void GuardedPoolAllocator::disable() { PoolMutex.lock(); }
+
+void GuardedPoolAllocator::enable() { PoolMutex.unlock(); }
+
+void GuardedPoolAllocator::uninitTestOnly() {
+ if (GuardedPagePool) {
+ unmapMemory(reinterpret_cast<void *>(GuardedPagePool),
+ GuardedPagePoolEnd - GuardedPagePool);
+ GuardedPagePool = 0;
+ GuardedPagePoolEnd = 0;
+ }
+ if (Metadata) {
+ unmapMemory(Metadata, MaxSimultaneousAllocations * sizeof(*Metadata));
+ Metadata = nullptr;
+ }
+ if (FreeSlots) {
+ unmapMemory(FreeSlots, MaxSimultaneousAllocations * sizeof(*FreeSlots));
+ FreeSlots = nullptr;
+ }
+ uninstallSignalHandlers();
}
void *GuardedPoolAllocator::allocate(size_t Size) {
diff --git a/guarded_pool_allocator.h b/guarded_pool_allocator.h
index 7e6e137..c9a5e5e 100644
--- a/guarded_pool_allocator.h
+++ b/guarded_pool_allocator.h
@@ -98,14 +98,22 @@
// pool using the provided options. See options.inc for runtime configuration
// options.
void init(const options::Options &Opts);
+ void uninitTestOnly();
+
+ void disable();
+ void enable();
// Return whether the allocation should be randomly chosen for sampling.
GWP_ASAN_ALWAYS_INLINE bool shouldSample() {
// NextSampleCounter == 0 means we "should regenerate the counter".
// == 1 means we "should sample this allocation".
+ // AdjustedSampleRatePlusOne is designed to intentionally underflow. This
+ // class must be valid when zero-initialised, and we wish to sample as
+ // infrequently as possible when this is the case, hence we underflow to
+ // UINT32_MAX.
if (GWP_ASAN_UNLIKELY(ThreadLocals.NextSampleCounter == 0))
ThreadLocals.NextSampleCounter =
- (getRandomUnsigned32() % AdjustedSampleRate) + 1;
+ (getRandomUnsigned32() % (AdjustedSampleRatePlusOne - 1)) + 1;
return GWP_ASAN_UNLIKELY(--ThreadLocals.NextSampleCounter == 0);
}
@@ -114,7 +122,7 @@
// is owned by this pool.
GWP_ASAN_ALWAYS_INLINE bool pointerIsMine(const void *Ptr) const {
uintptr_t P = reinterpret_cast<uintptr_t>(Ptr);
- return GuardedPagePool <= P && P < GuardedPagePoolEnd;
+ return P < GuardedPagePoolEnd && GuardedPagePool <= P;
}
// Allocate memory in a guarded slot, and return a pointer to the new
@@ -156,6 +164,7 @@
// mappings, call mapMemory() followed by markReadWrite() on the returned
// pointer.
void *mapMemory(size_t Size) const;
+ void unmapMemory(void *Addr, size_t Size) const;
void markReadWrite(void *Ptr, size_t Size) const;
void markInaccessible(void *Ptr, size_t Size) const;
@@ -169,6 +178,7 @@
// signal(), we have to use platform-specific signal handlers to obtain the
// address that caused the SIGSEGV exception.
static void installSignalHandlers();
+ static void uninstallSignalHandlers();
// Returns the index of the slot that this pointer resides in. If the pointer
// is not owned by this pool, the result is undefined.
@@ -210,6 +220,11 @@
void reportErrorInternal(uintptr_t AccessPtr, Error E);
+ static GuardedPoolAllocator *getSingleton();
+
+ // Install a pthread_atfork handler.
+ void installAtFork();
+
// Cached page size for this system in bytes.
size_t PageSize = 0;
@@ -223,7 +238,7 @@
size_t NumSampledAllocations = 0;
// Pointer to the pool of guarded slots. Note that this points to the start of
// the pool (which is a guard page), not a pointer to the first guarded page.
- uintptr_t GuardedPagePool = UINTPTR_MAX;
+ uintptr_t GuardedPagePool = 0;
uintptr_t GuardedPagePoolEnd = 0;
// Pointer to the allocation metadata (allocation/deallocation stack traces),
// if any.
@@ -250,7 +265,7 @@
// where we would calculate modulo zero. This value is set UINT32_MAX, as when
// GWP-ASan is disabled, we wish to never spend wasted cycles recalculating
// the sample rate.
- uint32_t AdjustedSampleRate = UINT32_MAX;
+ uint32_t AdjustedSampleRatePlusOne = 0;
// Pack the thread local variables into a struct to ensure that they're in
// the same cache line for performance reasons. These are the most touched
diff --git a/options.inc b/options.inc
index df6c46e..97500d3 100644
--- a/options.inc
+++ b/options.inc
@@ -39,3 +39,7 @@
"programs that install further signal handlers should make sure they do "
"the same. Note, if the previously installed SIGSEGV handler is SIG_IGN, "
"we terminate the process after dumping the error report.")
+
+GWP_ASAN_OPTION(bool, InstallForkHandlers, true,
+ "Install GWP-ASan atfork handlers to acquire internal locks "
+ "before fork and release them after.")
diff --git a/platform_specific/guarded_pool_allocator_posix.cpp b/platform_specific/guarded_pool_allocator_posix.cpp
index 8bc0aef..0083308 100644
--- a/platform_specific/guarded_pool_allocator_posix.cpp
+++ b/platform_specific/guarded_pool_allocator_posix.cpp
@@ -8,9 +8,10 @@
#include "gwp_asan/guarded_pool_allocator.h"
-#include <stdlib.h>
#include <errno.h>
#include <signal.h>
+#include <stdlib.h>
+#include <string.h>
#include <sys/mman.h>
#include <sys/syscall.h>
#include <sys/types.h>
@@ -30,6 +31,16 @@
return Ptr;
}
+void GuardedPoolAllocator::unmapMemory(void *Addr, size_t Size) const {
+ int Res = munmap(Addr, Size);
+
+ if (Res != 0) {
+ Printf("Failed to unmap guarded pool allocator memory, errno: %d\n", errno);
+ Printf(" unmmap(%p, %zu, ...) failed.\n", Addr, Size);
+ exit(EXIT_FAILURE);
+ }
+}
+
void GuardedPoolAllocator::markReadWrite(void *Ptr, size_t Size) const {
if (mprotect(Ptr, Size, PROT_READ | PROT_WRITE) != 0) {
Printf("Failed to set guarded pool allocator memory at as RW, errno: %d\n",
@@ -58,6 +69,7 @@
}
struct sigaction PreviousHandler;
+bool SignalHandlerInstalled;
static void sigSegvHandler(int sig, siginfo_t *info, void *ucontext) {
gwp_asan::GuardedPoolAllocator::reportError(
@@ -78,11 +90,31 @@
}
}
+void GuardedPoolAllocator::installAtFork() {
+ auto Disable = []() {
+ if (auto *S = getSingleton())
+ S->disable();
+ };
+ auto Enable = []() {
+ if (auto *S = getSingleton())
+ S->enable();
+ };
+ pthread_atfork(Disable, Enable, Enable);
+}
+
void GuardedPoolAllocator::installSignalHandlers() {
struct sigaction Action;
Action.sa_sigaction = sigSegvHandler;
Action.sa_flags = SA_SIGINFO;
sigaction(SIGSEGV, &Action, &PreviousHandler);
+ SignalHandlerInstalled = true;
+}
+
+void GuardedPoolAllocator::uninstallSignalHandlers() {
+ if (SignalHandlerInstalled) {
+ sigaction(SIGSEGV, &PreviousHandler, nullptr);
+ SignalHandlerInstalled = false;
+ }
}
uint64_t GuardedPoolAllocator::getThreadID() {
diff --git a/tests/enable_disable.cpp b/tests/enable_disable.cpp
new file mode 100644
index 0000000..2c6ba51
--- /dev/null
+++ b/tests/enable_disable.cpp
@@ -0,0 +1,86 @@
+//===-- enable_disable.cpp --------------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "gwp_asan/tests/harness.h"
+
+constexpr size_t Size = 100;
+
+TEST_F(DefaultGuardedPoolAllocator, Fork) {
+ void *P;
+ pid_t Pid = fork();
+ EXPECT_GE(Pid, 0);
+ if (Pid == 0) {
+ P = GPA.allocate(Size);
+ EXPECT_NE(P, nullptr);
+ memset(P, 0x42, Size);
+ GPA.deallocate(P);
+ _exit(0);
+ }
+ waitpid(Pid, nullptr, 0);
+ P = GPA.allocate(Size);
+ EXPECT_NE(P, nullptr);
+ memset(P, 0x42, Size);
+ GPA.deallocate(P);
+
+ // fork should stall if the allocator has been disabled.
+ EXPECT_DEATH(
+ {
+ GPA.disable();
+ alarm(1);
+ Pid = fork();
+ EXPECT_GE(Pid, 0);
+ },
+ "");
+}
+
+namespace {
+pthread_mutex_t Mutex;
+pthread_cond_t Conditional = PTHREAD_COND_INITIALIZER;
+bool ThreadReady = false;
+
+void *enableMalloc(void *arg) {
+ auto &GPA = *reinterpret_cast<gwp_asan::GuardedPoolAllocator *>(arg);
+
+ // Signal the main thread we are ready.
+ pthread_mutex_lock(&Mutex);
+ ThreadReady = true;
+ pthread_cond_signal(&Conditional);
+ pthread_mutex_unlock(&Mutex);
+
+ // Wait for the malloc_disable & fork, then enable the allocator again.
+ sleep(1);
+ GPA.enable();
+
+ return nullptr;
+}
+
+TEST_F(DefaultGuardedPoolAllocator, DisableForkEnable) {
+ pthread_t ThreadId;
+ EXPECT_EQ(pthread_create(&ThreadId, nullptr, &enableMalloc, &GPA), 0);
+
+ // Do not lock the allocator right away, the other thread may need it to start
+ // up.
+ pthread_mutex_lock(&Mutex);
+ while (!ThreadReady)
+ pthread_cond_wait(&Conditional, &Mutex);
+ pthread_mutex_unlock(&Mutex);
+
+ // Disable the allocator and fork. fork should succeed after malloc_enable.
+ GPA.disable();
+ pid_t Pid = fork();
+ EXPECT_GE(Pid, 0);
+ if (Pid == 0) {
+ void *P = GPA.allocate(Size);
+ EXPECT_NE(P, nullptr);
+ GPA.deallocate(P);
+ _exit(0);
+ }
+ waitpid(Pid, nullptr, 0);
+ EXPECT_EQ(pthread_join(ThreadId, 0), 0);
+}
+} // namespace
diff --git a/tests/harness.cpp b/tests/harness.cpp
new file mode 100644
index 0000000..77c25ee
--- /dev/null
+++ b/tests/harness.cpp
@@ -0,0 +1,10 @@
+#include "harness.h"
+
+namespace gwp_asan {
+namespace test {
+bool OnlyOnce() {
+ static int x = 0;
+ return !x++;
+}
+} // namespace test
+} // namespace gwp_asan
diff --git a/tests/harness.h b/tests/harness.h
index 77f7b51..0851d7e 100644
--- a/tests/harness.h
+++ b/tests/harness.h
@@ -24,20 +24,27 @@
// `optional/printf_sanitizer_common.cpp` which supplies the __sanitizer::Printf
// for this purpose.
options::Printf_t getPrintfFunction();
+
+// First call returns true, all the following calls return false.
+bool OnlyOnce();
+
}; // namespace test
}; // namespace gwp_asan
class DefaultGuardedPoolAllocator : public ::testing::Test {
public:
- DefaultGuardedPoolAllocator() {
+ void SetUp() override {
gwp_asan::options::Options Opts;
Opts.setDefaults();
MaxSimultaneousAllocations = Opts.MaxSimultaneousAllocations;
Opts.Printf = gwp_asan::test::getPrintfFunction();
+ Opts.InstallForkHandlers = gwp_asan::test::OnlyOnce();
GPA.init(Opts);
}
+ void TearDown() override { GPA.uninitTestOnly(); }
+
protected:
gwp_asan::GuardedPoolAllocator GPA;
decltype(gwp_asan::options::Options::MaxSimultaneousAllocations)
@@ -56,9 +63,12 @@
MaxSimultaneousAllocations = MaxSimultaneousAllocationsArg;
Opts.Printf = gwp_asan::test::getPrintfFunction();
+ Opts.InstallForkHandlers = gwp_asan::test::OnlyOnce();
GPA.init(Opts);
}
+ void TearDown() override { GPA.uninitTestOnly(); }
+
protected:
gwp_asan::GuardedPoolAllocator GPA;
decltype(gwp_asan::options::Options::MaxSimultaneousAllocations)
@@ -67,16 +77,19 @@
class BacktraceGuardedPoolAllocator : public ::testing::Test {
public:
- BacktraceGuardedPoolAllocator() {
+ void SetUp() override {
gwp_asan::options::Options Opts;
Opts.setDefaults();
Opts.Printf = gwp_asan::test::getPrintfFunction();
Opts.Backtrace = gwp_asan::options::getBacktraceFunction();
Opts.PrintBacktrace = gwp_asan::options::getPrintBacktraceFunction();
+ Opts.InstallForkHandlers = gwp_asan::test::OnlyOnce();
GPA.init(Opts);
}
+ void TearDown() override { GPA.uninitTestOnly(); }
+
protected:
gwp_asan::GuardedPoolAllocator GPA;
};
